You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomee.apache.org by rzo1 <gi...@git.apache.org> on 2018/12/14 10:09:51 UTC
[GitHub] tomee pull request #276: TOMEE-2363 Introduces OWASP dependency check via pr...
GitHub user rzo1 opened a pull request:
https://github.com/apache/tomee/pull/276
TOMEE-2363 Introduces OWASP dependency check via profile
This PR introduces the [OWASP Dependency Check Maven Plugin](https://jeremylong.github.io/DependencyCheck/index.html) in a basic configuration at the parent pom level of the project.
As the dependency checking is quite expensive (see time below), I added it is a separate profile `owasp`. To enable it in the Maven build process, you just need to add `-Powasp`. An aggregated report `dependency-check-report.html` is created in the target directory of the root project.
I also added some exclusions related to false positives (see `owasp-dc-suppression.xml`).
I also added the aggregated output for the run on my second system: [dependency-check-report.zip](https://github.com/apache/tomee/files/2679597/dependency-check-report.zip)
Some timings for my system (here Windows, on Linux it is a lot faster...)
QuickBuild without OWASP: 07:08 min
QuickBuild with OWASP 1st RUN: 26:02 min (pre-caching vulnerabilities)
QuickBuild with OWASP 2nd+ RUN: 13:06 min
Note, that I did not yet include failing the build based on CVE scores. However, we should decide on a common CVE score value to do so on the CI systems. If this PR holds your expectations, I can backport this to 7.0.x and 7.1.x branches. In a next step, we can analyze the outcomes and create JIRA issue and/or enhance the supress configuration for false positives.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/rzo1/tomee TOMEE-2363-OWASP-Dependency
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/tomee/pull/276.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #276
----
commit abac13284b8483327c183fb6490a1d6ee15f81b8
Author: rzo1 <ri...@...>
Date: 2018-12-13T16:18:20Z
TOMEE-2363 Introduces OWASP dependency check via profile
----
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by rzo1 <gi...@git.apache.org>.
Github user rzo1 commented on the issue:
https://github.com/apache/tomee/pull/276
Hey @jeanouii & @radcortez
thanks for the feedback - I can update this PR.
I would propose:
- (1) I will add a profile `owasp-report` to generate the aggregated HTML report, which can be triggered manually as it takes a long time
- (2) I will add a profile `owasp-check`, which does not generate HTML reports (which will speed up this process) and which will **fail** the build for CVE's greater a specific value. This profile can then be added on the CI System (build bot), which may support caching the owasp CVE files (so we will get a speed boost).
What do you think?
---
[GitHub] tomee pull request #276: TOMEE-2363 Introduces OWASP dependency check via pr...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/tomee/pull/276
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by jeanouii <gi...@git.apache.org>.
Github user jeanouii commented on the issue:
https://github.com/apache/tomee/pull/276
BTW, happy to check that in as a first step and you can create another PR for iteration 2.
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by radcortez <gi...@git.apache.org>.
Github user radcortez commented on the issue:
https://github.com/apache/tomee/pull/276
@rzo1 that sounds great. I'll try it.
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by jeanouii <gi...@git.apache.org>.
Github user jeanouii commented on the issue:
https://github.com/apache/tomee/pull/276
HI,
Thanks for the PR and the details.
From my experience, in this kind of situation, if the check is not activated and does not make the build to fail, it's not so useful.
So I'd VOTE to at least have the profile activated on our CI system (buildbot). And if it fails it needs to fail the build.
Thoughts?
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by rzo1 <gi...@git.apache.org>.
Github user rzo1 commented on the issue:
https://github.com/apache/tomee/pull/276
Thanks for merging this in. Can anyone add the profile on the CI system?
I will start to backport the changes now.
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by rzo1 <gi...@git.apache.org>.
Github user rzo1 commented on the issue:
https://github.com/apache/tomee/pull/276
I adjusted the PR to my comments above.
Feel free to give any other suggestions. If we introduce this, I would recommend to add `owasp-check` to the CI system. Who can do this?
The CVE score to fail the build needs to be greater 8.0 atm.
---
[GitHub] tomee issue #276: TOMEE-2363 Introduces OWASP dependency check via profile
Posted by jeanouii <gi...@git.apache.org>.
Github user jeanouii commented on the issue:
https://github.com/apache/tomee/pull/276
Sounds perfect @rzo1 .
@radcortez I am ready to merge. Did you get a chance to also review and test?
---